ISO/IEC 42001 implementation guide

ISO/IEC 42001:2023 is an international management-system standard for organizations that provide or use AI products and services. ISO describes it as specifying requirements to establish, implement, maintain, and continually improve an Artificial Intelligence Management System, or AIMS.

An AIMS is the organizational system around AI: policy, responsibilities, objectives, resources, operational controls, risk and impact processes, performance evaluation, and improvement. It should govern the AI systems inside an agreed scope and connect to the organization's existing management and delivery processes.

ISO/IEC 42001 does not certify an individual model as accurate, safe, fair, or compliant. It assesses whether an organization has a management system that meets the standard's requirements and operates that system. Product, legal, technical, and sector assurance remain necessary.

ISO develops standards but does not perform certification or issue certificates. ISO states that certification is carried out by external certification bodies. Accreditation provides independent recognition of a certification body's competence, although ISO notes that accreditation is not compulsory.

An organization preparing for certification should define why certification matters, which entities and activities are in scope, which certification body requirements apply, and how it will verify the body's competence and accreditation status. Avoid claims that an organization is certified by ISO.

A scope that is too broad can produce an unmanageable first implementation. A scope that excludes the people, suppliers, products, or operating processes that control material AI risk will not describe reality. Define legal entities, business functions, locations, products, lifecycle activities, and interfaces with other management systems.

Create an AI inventory before finalizing scope. Include internally developed models, model APIs, embedded vendor AI, automated decisions, AI-enabled security tools, and material experiments approaching production. Record who provides and who uses each system, because controls differ across those roles.

The workstreams below translate management-system requirements into an operating programme without reproducing the standard. The authoritative requirements remain in the licensed ISO/IEC 42001 text.

Do not operate risk assessment as an annual register exercise. Define when an assessment starts, who contributes, how affected people and contexts are considered, how criteria are applied, and which decisions follow from the result. Trigger reassessment when intended use, data, models, suppliers, users, permissions, law, or operating context changes materially.

Risk and impact records should connect to requirements, evaluations, controls, residual risk, approval, and monitoring. The AIMS should make it possible to trace why a system was permitted, restricted, changed, or retired.

Buying AI does not transfer accountability for how it is selected, integrated, configured, used, monitored, or changed. Supplier controls should be proportional to the system's impact, data, authority, criticality, and substitutability.

Procurement evidence should cover intended use, data flows, models and subprocessors, evaluation, security, availability, changes, incidents, human oversight, monitoring, contractual rights, and exit. Where a supplier cannot provide evidence, record the uncertainty and decide whether technical or operational controls reduce it sufficiently.

A readiness assessment should test whether the management system operates. Score each workstream against evidence and repeatability rather than whether a document exists. The scale below is Kesho's assessment model, not an ISO maturity model.

Ninety days can establish the operating core for a bounded scope; it does not guarantee certification readiness. Certification timing depends on scope, existing systems, risk, evidence maturity, audit findings, and certification-body arrangements.

NIST AI RMF is a voluntary, flexible risk framework organized around Govern, Map, Measure, and Manage. ISO/IEC 42001 is a requirements-based management-system standard. An organization can use AI RMF outcomes and Playbook suggestions inside an AIMS, but one does not automatically establish conformity with the other.

Map controls once and preserve the source requirement. A useful crosswalk identifies common evidence, partial coverage, and obligations unique to each framework. Avoid treating a crosswalk as proof that implementation or certification has been achieved.

The organization should be able to explain its scope, show that roles understand their responsibilities, produce current records from representative AI systems, demonstrate internal audit and management review, and show that findings lead to corrective action. Evidence should be consistent with actual product and operating practice.